Does the best workflow for Laravel/Github/Forge/DigitalOcean involve putting all files into Github, except you .env file and making changes to the .env file manually on your staging and production servers?
Does anyone put their .env file in their Github repository?
Any advice is appreciated.
Yes, the best workflow is to exclude the .env file from the repo and make the changes manually on each environment. A .env file should never be included in a repository since it contains credentials. Even if the repository is private. As the name suggests, a .env file should be specific to the environment as should the credentials they contain. See in the Laravel docs - https://laravel.com/docs/8.x/configuration#environment-file-security
@idew Great points! So do you FTP up the first copy of the file and then edit directly on the server?
@WallyJ Yeah unless you're using something like Laravel Forge which has a tool in the GUI for editing the .env.
@WallyJ and an alternative to ftp. There is an example env that is part of the repo. You can edit it. Not completely applicable. But I just wrote an article on how to deploy a site using ssh. There is a step on env
https://dev.to/webrobert/sop-for-creating-deploying-managing-websites-on-bluehost-shared-46m5
@idew Nice. I am using Laravel Forge. So you can edit the .env on each server that you have set up in Forge?
@WallyJ seems that you can edit them on the dashboard https://forge.laravel.com/docs/1.0/sites/deployments.html#environments
You can create and edit your Environment file within the Forge site's management dashboard.
@wallyj .env files are a replacement for environment variables. They’re for use in environments where it’s difficult or impractical to set real environment variables.
Your .env file should be nowhere near your source control repository (given it’ll contain sensitive information like database credentials, API keys and secrets, etc); and you should be using environment variables proper on your staging and production servers.
The idea is that, configuration should be dictated by the environment and not the application. You should be able to deploy your codebase as is to any server and it’ll inherit the appropriate configuration from the environment it’s running in. You shouldn’t need to make any code changes to update its configuration.
Please or to participate in this conversation.